NEW DELHI, October 17 — The National Cyber Security Coordinator (NCSC), operating within the National Security Council Secretariat (NSCS), issued a binding cybersecurity directive on Saturday establishing stringent cyber-resilience benchmarks across designated Critical Information Infrastructure (CII) sectors.
The regulatory guidelines mandate all entities operating in power grids, banking networks, telecom exchanges, strategic defence suppliers, and urban rail logistics to transition toward Zero Trust Architectures and air-gap sensitive operational technology (OT/SCADA) networks from public Internet access. Furthermore, institutions must conduct bi-monthly Vulnerability Assessment and Penetration Testing (VAPT) and report any security incidents to CERT-In and NCIIPC within an uncompromised 6-hour window.
The directive emphasizes strict hardware supply chain provenance, requiring public and private utilities to procure telecommunication and supervisory control hardware exclusively from Trusted Sources certified under the National Cyber Security Directive, shielding sovereign infrastructure from foreign backdoor surveillance and ransomware disruptions.
Statutory provisions governing Critical Information Infrastructure under Section 70 of the Information Technology Act 2000, institutional powers of NCIIPC (notified in 2014), the operational role of CERT-In under Section 70B, and the Budapest Convention on Cybercrime are cornerstone syllabus components for UPSC GS-III (Internal Security) and judicial service exams.